CVE-2026-105124 in wcms
Summary
by MITRE • 10/04/2026
W (vincent-peugnet/wcms) through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or comment URLs echoed into href attributes in editrightbar.php, executing script with administrator or editor privileges.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/04/2026
The vulnerability identified in W CMS versions through 3.18.0 represents a critical security flaw classified as Stored Cross-Site Scripting (XSS), formally known under the Common Weakness Enumeration standard as CWE-79. This type of injection attack occurs when an application includes untrusted data in a new web page without proper validation or escaping, allowing malicious scripts to execute in the victim's browser. In this specific instance, the flaw is persistent because the injected payloads are stored on the server and subsequently served to other users, rather than being executed immediately upon submission like reflected XSS attacks. The attack surface encompasses two distinct entry points within the application: the login user field processed by adminlog.php and the visitor comment website field handled by editrightbar.php.
The first vector involves the administrative logging mechanism found in adminlog.php. When an attacker submits a failed login attempt, the username provided is written to the server-side logs without adequate sanitization. Subsequently, when an administrator or authorized user views these logs through the same interface, the unescaped script tags contained within the stored username are rendered by the browser as executable code. This allows the attacker to execute arbitrary JavaScript in the context of the logged-in administrative session. Because this occurs during a routine review of login attempts, it targets high-privilege users who may not suspect malicious activity in standard log entries, thereby facilitating privilege escalation and potential full system compromise if combined with other vulnerabilities or social engineering tactics.
The second vector exploits the comment functionality via editrightbar.php. Here, the vulnerability lies in how visitor-provided website URLs are processed. Instead of being treated as plain text or properly encoded for safe display within HTML attributes, these values are echoed directly into href attributes without escaping special characters such as quotes or angle brackets. This allows an attacker to break out of the attribute context and inject event handlers like onmouseover or onclick, which trigger script execution when a user interacts with the comment section. Since comments are often visible to multiple users including editors and administrators, this stored payload persists in the database and executes for any viewer who triggers the malicious link, leading to session hijacking, credential theft via keyloggers, or defacement of the website interface.
From an operational perspective, the impact of these vulnerabilities is severe due to their persistent nature and high-privilege execution context. Successful exploitation can lead to unauthorized access to administrative panels, theft of sensitive user data including cookies and authentication tokens, redirection of users to phishing sites, and manipulation of page content for malicious purposes such as distributing malware or conducting further social engineering campaigns against the site's audience. The ability to execute scripts with administrator privileges effectively grants the attacker control over the application’s backend logic if they can leverage additional vulnerabilities like CSRF or insecure direct object references that might be present in the same system.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The primary technical fix involves implementing strict input validation and output encoding for all user-supplied data, particularly fields destined for HTML contexts such as log viewers and comment sections. Developers should utilize context-aware escaping functions provided by modern web frameworks to ensure that special characters are converted into their corresponding HTML entities before rendering. Additionally, the implementation of a Content Security Policy (CSP) can significantly reduce the impact of any remaining XSS vulnerabilities by restricting the sources from which scripts can be loaded or executed. Upgrading W CMS to version 3.18.1 or later is essential as it contains patches for these specific flaws. Regular security audits and penetration testing focused on input handling in administrative interfaces are also recommended to detect similar weaknesses before they can be exploited.